Patch available CVSS 7.5 Security news
Apple fixes an iMessage flaw that let a remote attacker join group chats and read messages
On 9 November 2026 Apple shipped iOS 27.2.1, macOS Golden Gate 27.2.1 and updates for older systems. They fix a bug that could let a remote attacker join an iMessage group chat and receive its messages, along with several Bluetooth pairing flaws. Apple reports no exploitation, but this update is worth installing now.
Key points
- CVE-2026-113961 in Messages could let a remote attacker join an iMessage group chat and receive its messages. A second bug, CVE-2026-113960, let someone newly added to a group read messages sent before they joined.
- Other fixes cover Bluetooth and AirPlay pairing: an attacker in Bluetooth range could bypass the limit on pairing-code attempts and, according to Apple, pair with a device without user interaction.
- The updates also fix CVE-2026-111497 in the Brotli compression library, which CISA has listed as exploited since 27 October 2026. Apple does not say it was exploited against its devices.
- Fixed in iOS and iPadOS 27.2.1 and 26.7.3, macOS 27.2.1, 26.7.3 and 15.8.3, watchOS 27.2.1 and visionOS 27.2.1 (all released 9 November 2026).
Vulnerabilities: CVE-2026-113961, CVE-2026-113960, CVE-2026-113964, CVE-2026-113965, CVE-2026-113970, CVE-2026-111497
What happened
On 9 November 2026 Apple released security updates for iPhone, iPad, Mac, Apple Watch and Vision Pro. For most people, the headline fixes are two bugs in Messages (iMessage):
- CVE-2026-113961 – a remote attacker could join an iMessage group chat and receive its messages.
- CVE-2026-113960 – someone newly added to a group could read messages sent before they were added.
The other fixes cover Bluetooth and AirPlay pairing and the Brotli compression library. Apple does not say any of these flaws have been exploited.
Technical details
Apple publishes only short descriptions. Here is what we could verify:
| CVE | Component | What an attacker could do | Bug type (Apple / NVD) |
|---|---|---|---|
| CVE-2026-113961 | Messages | remotely join an iMessage group chat and receive its messages | authorization issue, CWE-863; CVSS 3.1 7.5 |
| CVE-2026-113960 | Messages | as a new group member, read earlier messages | Apple removed the vulnerable code |
| CVE-2026-113964 | CoreUtils | from Bluetooth range, bypass the pairing-code attempt limit and pair without user interaction | logic issue, CWE-307; CVSS 3.1 5.4 |
| CVE-2026-113965 | CoreUtils | use a malicious Bluetooth device to pair without user interaction | insufficient checks |
| CVE-2026-113968, -113969 | AirPlay, rapportd | bypass the AirPlay pairing-code attempt limit (over Bluetooth or from the same network) | logic issue |
| CVE-2026-113970 | Bluetooth | from Bluetooth range, corrupt process memory | use-after-free |
| CVE-2026-111497 | Brotli | corrupt memory with crafted input | out-of-bounds write, CWE-787 |
The CVSS scores come from a secondary source listed in NVD. As of 10 November 2026, NVD had not yet analysed the Apple entries (status "Received").
The iMessage bugs matter because they need neither physical access nor proximity – Apple describes the attacker as "remote". Apple doesn't explain how an attacker could get into a group; the bug was reported by an anonymous researcher. The Bluetooth flaws, by contrast, require the attacker to be physically nearby, for example in a café or on a train.
Brotli is Google's open-source compression library, used by browsers and plenty of other software. CISA added this Brotli flaw to its Known Exploited Vulnerabilities (KEV) catalog on 27 October 2026. Apple does not say it was exploited against Apple devices.
Who is affected
The Messages fixes ship in these versions (all released 9 November 2026):
- iOS and iPadOS 27.2.1 and 26.7.3 – iPhone 11 and later, recent iPads,
- macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3,
- watchOS 27.2.1 (Apple Watch Series 9 and later),
- visionOS 27.2.1 (Vision Pro).
iPhone XS, XS Max, XR and iPad (7th generation) got iOS 18.7.12, and older watches (Series 6 to 8, SE 2nd generation, Ultra) got watchOS 26.6.1. Both fix the Bluetooth and AirPlay issues, but the Messages fixes are not on their lists. Apple doesn't say whether those older systems were affected by the Messages bugs.
How to tell if you were compromised
Apple has published no indicators of compromise and reports no exploitation. Things you can check yourself (our suggestions):
- Group chat members – open each group chat, tap the group name at the top and review who is in it. Check any unknown number or address with the other members.
- Paired Bluetooth devices – under Settings → Bluetooth (on a Mac, System Settings → Bluetooth), remove any device you don't recognise.
What to do
- iPhone and iPad: Settings → General → Software Update → install iOS 27.2.1 (or 26.7.3; 18.7.12 on older models).
- Mac: System Settings → General → Software Update → macOS 27.2.1, 26.7.3 or 15.8.3.
- Apple Watch: in the Watch app on your iPhone → General → Software Update.
- Turn on automatic updates so future fixes arrive on their own.
- Organisations using MDM – enforce the minimum versions above and find devices that have fallen behind.
Timeline
Updates
- 10 November 2026 – first version of this article.
FAQ
Could someone have read my private messages?
According to Apple, the flaw affected iMessage group chats, not one-to-one conversations. Apple does not say anyone exploited it, and it is fixed once you update.
I have an older iPhone XS or XR. Am I affected?
Those models got iOS 18.7.12 with the Bluetooth and AirPlay fixes. The Messages fixes are not on its list, and Apple doesn't say whether those bugs affected iOS 18. Install the update either way.
How can I tell if a stranger is in one of my group chats?
Open the chat and tap the group name at the top to see the member list. If you don't recognise a number or email address, ask the other members and remove it if needed.
Do I need to do anything after updating?
We suggest reviewing paired devices under Settings → Bluetooth and removing any you don't recognise. Apple doesn't explicitly ask for this.
Sources
- Apple – About the security content of iOS 27.2.1 and iPadOS 27.2.1 (9 November 2026)
- Apple – About the security content of iOS 26.7.3 and iPadOS 26.7.3
- Apple – About the security content of macOS Golden Gate 27.2.1
- Apple – About the security content of iOS 18.7.12 and iPadOS 18.7.12
- Apple – Apple security releases
- NVD – CVE-2026-113961
- NVD – CVE-2026-111497 (Brotli, CISA KEV)
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
Arara Message breach: 81 million email addresses stolen and phishing sent in card issuers' names
An attacker broke into Arara Message, a Japanese bulk email delivery service, took more than 81 million email addresses belonging to the customers of roughly 380 companies, and used the service itself to send up to 7.13 million phishing emails posing as credit card companies. The fallout is now reaching downstream customers: on 13 November 2026 the City of Osaka disclosed that 1.08 million addresses of users of its online services system were exposed. Here is what is confirmed and what it means for defenders and users.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.